# Find all Python py_test targets not tagged "no_pip" or "manual", excluding
  # any targets in ignored packages. Combine this list of targets into a bazel
  # query list (e.g. the list becomes "target+target2+target3")

  private static final ImmutableSet<String> NO_PS =
      ImmutableSet.of("www", "foo.ihopethiswillneverbeapublicsuffix", "x.y.z");

  /**
   * Having a public suffix is equivalent to having a registry suffix, because all registry suffixes
   * are public suffixes, and all public suffixes have registry suffixes.
   */
  private static final ImmutableSet<String> NO_RS = NO_PS;

  private static final ImmutableSet<String> NON_PS =

// NOTE that this expects to be run from within the HOST network namespace!
//
// We need to do this specifically to be able to distinguish between traffic coming from different node-level processes
// via the nodeIP
// - kubelet (node-local healthchecks, which we do not capture)
// - kube-proxy (fowarded/proxied traffic from LoadBalancer-backed services, potentially with public IPs, which we must capture)

- The `--bind-address` parameter in kube-proxy is misleading, no port is opened with this address. Instead it is translated internally to "nodeIP". The nodeIPs for both families are now taken from the Node object if `--bind-address` is unspecified or set to the "any" address (0.0.0.0 or ::). It is recommended to leave `--bind-address` unspecified, and in particular avoid to set it to localhost...